PT-2017-2244 · Gnu+3 · Glibc+3

Publicado 2015-12-09 · Atualizado 2024-05-16 · CVE-2014-9984

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions glibc versions prior to 2.20

Description The issue is related to the nscd daemon in the GNU C Library, where it does not correctly compute the size of an internal buffer when processing netgroup requests. This could lead to a crash of the nscd daemon or potentially allow code execution as the user running nscd. The vulnerability may be exploited by a remote attacker to cause a denial of service or to inject code by running the nscd service.

Recommendations For versions prior to 2.20, update to version 2.20 or later to resolve the issue. As a temporary workaround, consider restricting access to the nscd daemon to minimize the risk of exploitation.

Exploit

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

ALT-PU-2015-2084

BDU:2017-01438

CVE-2014-9984

SUSE-SU-2018:0076-1

USN-6762-1

Produtos afetados

Alt Linux

Suse

Ubuntu

Glibc

Referências · 215

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/magento_xxe_to_glibc_buf_overflow.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/smtp/exim_gethostbyname_bof.rb · Exploit
• 🔥 https://github.com/ambionics/cnext-exploits · Exploit
• 🔥 https://github.com/aaronfay/CVE-2015-0235-test · Exploit
• 🔥 https://github.com/makelinux/CVE-2015-0235-workaround · Exploit
• 🔥 https://github.com/arm13/ghost_exploit · Exploit
• 🔥 https://github.com/rvizx/CVE-2024-2961 · Exploit
• 🔥 https://github.com/mikesplain/CVE-2015-0235-cookbook · Exploit
• 🔥 https://github.com/mholzinger/CVE-2015-0235_GHOST · Exploit
• 🔥 https://github.com/geekben/cve-collections/blob/master/cve20150235poc.c · Exploit
• https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/wordpress_ghost_scanner.rb · Nota
• https://github.com/fser/ghost-checker · Nota
• https://bdu.fstec.ru/vul/2016-02234 · Nota de Segurança
• https://sourceware.org/bugzilla/show_bug.cgi?id=16695 · Correção
• https://bdu.fstec.ru/vul/2015-05872 · Nota de Segurança